Please excuse my ignorance if the answer to this is painfully obvious. So let's say I publish a workbook to Tableau Online which uses a SQL server on our company's network as the data source. I've extracted the data and I publish it separately to Online's servers and then I use Tableau Bridge to facilitate extract refreshes on a defined schedule from there on out. The Bridge client PC is now executing those extract refreshes locally from behind our firewall, correct? What happens to the data extract after the Bridge client completes the refresh? Does that extracted data physically reside on the Bridge client PC, and then whenever someone interacts with the workbook the extract on the Bridge client is queried and the results sent back to Tableau Online? Or does the Bridge client publish the extract to the Tableau Online server every time a refresh is completed? Just trying to understand where the data extract physically resides when using Tableau Bridge to schedule refreshes. I can't locate an extract file anywhere in the "My Tableau Repository" file on the Bridge client PC, which leads me to believe the refreshed extract is published back to the Tableau Online server even though the refresh operation itself is handled locally on the client PC. Can someone confirm that my understanding is correct?

Thanks, Mark. That's what I figured, but I just wanted to verify I was understanding it correctly. Our IT group is balking at enterprise adoption of Tableau Online because they have security concerns about data extracts published to Online's servers not being encrypted at rest (apparently it's only encrypted in transit). My thought was that if the extract is being refreshed locally via Bridge, maybe that extract is also being stored on-premises as well, in which case that concern could be resolved. I guess we'll just use live connections.